{"id":"CVE-2026-52686","summary":"Wildcard CNAME proof validation bypass","details":"The issue is a DNSSEC validation bypass where wildcard expansion proofs (NSEC/NSEC3 records) are accepted without signature validation when the wildcard answer is a CNAME or DNAME record.","modified":"2026-08-12T16:09:43.726251Z","published":"2026-07-23T08:03:37.563Z","database_specific":{"cna_assigner":"OX","osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/52xxx/CVE-2026-52686.json"},"references":[{"type":"WEB","url":"https://repo.powerdns.com/"},{"type":"ADVISORY","url":"https://docs.powerdns.com/recursor/security-advisories/powerdns-advisory-powerdns-2026-10.html"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/52xxx/CVE-2026-52686.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-52686"},{"type":"PACKAGE","url":"https://github.com/PowerDNS/pdns"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/powerdns/pdns","events":[{"introduced":"544037cd123e8662877b5dc0b7963f5a094a2faf"},{"fixed":"b74225ba558d1f9f91afea21e2496e959b13a869"},{"introduced":"ff33413345dc6a826ff0f37f0c78cd60cdf15689"},{"fixed":"53dfd1af948d1ff716bfd7615c99d442f984f2af"},{"introduced":"c95adbda8ce519923dfdbe7947d82a2692e18af9"},{"fixed":"64c4f00f2b3d4d4153837e0dac7979108bb7749d"}],"database_specific":{"extracted_events":[{"introduced":"5.2.0"},{"fixed":"5.2.12"},{"introduced":"5.3.0"},{"fixed":"5.3.9"},{"introduced":"5.4.0"},{"fixed":"5.4.4"}],"source":"AFFECTED_FIELD"}}],"versions":["rec-5.2.10","rec-5.3.7","rec-5.4.2","rec-5.4.0-rc1","rec-5.4.0","rec-5.2.8","rec-5.3.4","rec-5.3.1","rec-5.2.6","rec-5.2.5","rec-5.3.0","rec-5.2.4","rec-5.2.2","rec-5.2.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-52686.json","vanir_signatures_modified":"2026-08-12T16:09:43Z","vanir_signatures":[{"id":"CVE-2026-52686-2c1afdfc","signature_type":"Line","signature_version":"v1","source":"https://github.com/powerdns/pdns/commit/53dfd1af948d1ff716bfd7615c99d442f984f2af","target":{"file":"pdns/recursordist/test-syncres_cc5.cc"},"deprecated":false,"digest":{"line_hashes":["178873075834533611826354203572646335453","68263735809913871838746811403036930818","294444694510304319079283491520384127394"],"threshold":0.9}},{"digest":{"function_hash":"321149023720598022539412040809182724434","length":2403},"id":"CVE-2026-52686-35f327f4","signature_type":"Function","signature_version":"v1","source":"https://github.com/powerdns/pdns/commit/64c4f00f2b3d4d4153837e0dac7979108bb7749d","target":{"file":"pdns/recursordist/test-syncres_cc3.cc","function":"BOOST_AUTO_TEST_CASE"},"deprecated":false},{"source":"https://github.com/powerdns/pdns/commit/64c4f00f2b3d4d4153837e0dac7979108bb7749d","target":{"file":"pdns/recursordist/test-syncres_cc5.cc"},"deprecated":false,"digest":{"line_hashes":["178873075834533611826354203572646335453","68263735809913871838746811403036930818","294444694510304319079283491520384127394"],"threshold":0.9},"id":"CVE-2026-52686-6bcd6862","signature_type":"Line","signature_version":"v1"},{"target":{"file":"pdns/recursordist/test-syncres_cc3.cc","function":"BOOST_AUTO_TEST_CASE"},"deprecated":false,"digest":{"function_hash":"258267957240144922330224967661450450682","length":2428},"id":"CVE-2026-52686-6cae02a6","signature_type":"Function","signature_version":"v1","source":"https://github.com/powerdns/pdns/commit/53dfd1af948d1ff716bfd7615c99d442f984f2af"},{"target":{"file":"pdns/recursordist/test-syncres_cc3.cc"},"deprecated":false,"digest":{"line_hashes":["106569573838865247464307234769346066715","337150974165016024551258499133453014952","218481867416778457803486745456845507383","157655217356913886569894448030175024547","248156571117347467765796622478284936084","307887380809890849389531454689952325347","51702223358558618912832015651184195290","235554931327345047041575667554445165376","162428951744519780812352849584821019985","17249239844122454052214489940024267068","60231686453930854969393532231747360909","95462097068831580277633752685695755496","326352126669537614206569303915384356609","73703024515535674936544244867854127173","60231686453930854969393532231747360909","178697427454676480772870741543305747383","165597800729126234550816218361303845739","100596704174744233326561554363384125365"],"threshold":0.9},"id":"CVE-2026-52686-76011dd0","signature_type":"Line","signature_version":"v1","source":"https://github.com/powerdns/pdns/commit/b74225ba558d1f9f91afea21e2496e959b13a869"},{"target":{"file":"pdns/recursordist/test-syncres_cc3.cc"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["33603439876409110263785087511525218320","74654839639281459608232486504707582691","225285901495535655876286067276264882660","248923153194528543087168242480905926413","108216919319730988085055095374831063971","14178690043366037878039177241800927421","156664093802573320955398940033836976928","278488168796688839512857130039481466315","162428951744519780812352849584821019985","17249239844122454052214489940024267068","60231686453930854969393532231747360909","95462097068831580277633752685695755496","326352126669537614206569303915384356609","73703024515535674936544244867854127173","138739682639390937155709743969849660680","97715549145799718766007427639761870407","165597800729126234550816218361303845739","100596704174744233326561554363384125365"]},"id":"CVE-2026-52686-7834f556","signature_type":"Line","signature_version":"v1","source":"https://github.com/powerdns/pdns/commit/64c4f00f2b3d4d4153837e0dac7979108bb7749d"},{"deprecated":false,"digest":{"function_hash":"11311640072020377701413772862222554475","length":2364},"id":"CVE-2026-52686-8a5aaf54","signature_type":"Function","signature_version":"v1","source":"https://github.com/powerdns/pdns/commit/b74225ba558d1f9f91afea21e2496e959b13a869","target":{"file":"pdns/recursordist/test-syncres_cc3.cc","function":"BOOST_AUTO_TEST_CASE"}},{"deprecated":false,"digest":{"line_hashes":["106569573838865247464307234769346066715","337150974165016024551258499133453014952","218481867416778457803486745456845507383","157655217356913886569894448030175024547","248156571117347467765796622478284936084","307887380809890849389531454689952325347","51702223358558618912832015651184195290","235554931327345047041575667554445165376","162428951744519780812352849584821019985","17249239844122454052214489940024267068","60231686453930854969393532231747360909","95462097068831580277633752685695755496","326352126669537614206569303915384356609","73703024515535674936544244867854127173","138739682639390937155709743969849660680","97715549145799718766007427639761870407","165597800729126234550816218361303845739","100596704174744233326561554363384125365"],"threshold":0.9},"id":"CVE-2026-52686-90cf4f85","signature_type":"Line","signature_version":"v1","source":"https://github.com/powerdns/pdns/commit/53dfd1af948d1ff716bfd7615c99d442f984f2af","target":{"file":"pdns/recursordist/test-syncres_cc3.cc"}},{"deprecated":false,"digest":{"line_hashes":["61123529858778556868434676469700833829","172192151217593938007461763699673554038","334031098597955816637463931250824513620","144092927544696201842525231323248028675","125364601277516619271008056276759613510","292339451060319529698601410068244870621","145368734622526732459095691986870150285","257641602359282688585110366670451835248","82276684157634677172891987079910472135","279568230016434762686300005486808232594","228454478493326969791383891315097681212","272307584847886740173261091502078231186","151186040936910880353869104747765600782","96634521900868265660556810104791666290","111690656414816116449727870568960866890","224175059376717234293934551562625711747","93205899823498420593240065338014104031","176113646396417689675597576401323210911","233368381172057152469052240950631651518","147228350144465925776158818059329616532","294171572668465934090004360442390250078","172971984414156566578013168285329558882","76518826411347545341447968654201528111","287036674253239750820707615364040372431","206417983724872551403588071857369601531","190301942541846331735240089066313943299","154757172545440668849437570984911071","100297734200759198975563110441824994088","84340766976620446047067835708138334576","269935357300254612252527048833911171658","93748529309838173492175295853710082554","129424820874993847529116070963047870901","99288272290264190256935684522887741369","196170717154135016223665361339421510706","180123053493720674990987942453243609849","281096763625437540190994747829376358479","123092499724207133284550188084850397192","156377717540603171085481970823325384007","105753165065393061097919375976739557309","139898771205710912304203928656518890553","275352633607350611309317444743551248874","88680560123909053252903416597268864817","190053403352906738263237380846642625514","339538497369717774285633659512474045841","161257042474926511671723190410639702492","90172337027019397345288351449721830269","16715741445812420456573926249797038729","205176771747096583481240612923586690353","152362791468733055665976935012550848976","44212538362987457055731350574196867911","181064023028173555713855454994317145990","337902410219924545282653803910599949821","257665780353633789054072576428447857312","266365902721351045421093662089433308526","293850398991963996058566640103429580857","317084925581858491889818480471675405972","328409990110020075899118305897980857514","32243119026549283233982570865308124256","37370521536392696182337227700701599394","164206158968753388913360339446085506837","20735636875069941819492467197481235384","259599458677180427318374307621606341632","12013551146669531838324780270564938596","294341267680978015218234067028470766256","146455459366941789385095040293914786464","10852551676209040866051156497043311505","147147281490762037630302429287068124692","73707210910882516307796677160556051752","15205899426777232943331497851876553098","31324263582972619781281825666767614241","68680874598283766253091873972817936207"],"threshold":0.9},"id":"CVE-2026-52686-9eed3a94","signature_type":"Line","signature_version":"v1","source":"https://github.com/powerdns/pdns/commit/b74225ba558d1f9f91afea21e2496e959b13a869","target":{"file":"pdns/recursordist/syncres.cc"}},{"deprecated":false,"digest":{"line_hashes":["297690379756825001883693258821284086787","275190756499235142776542164331574414796","304084711605878169466962246458596650124","130405718195737931270165725987888592811","125364601277516619271008056276759613510","292339451060319529698601410068244870621","145368734622526732459095691986870150285","257641602359282688585110366670451835248","82276684157634677172891987079910472135","279568230016434762686300005486808232594","228454478493326969791383891315097681212","272307584847886740173261091502078231186","151186040936910880353869104747765600782","96634521900868265660556810104791666290","111690656414816116449727870568960866890","224175059376717234293934551562625711747","93205899823498420593240065338014104031","176113646396417689675597576401323210911","233368381172057152469052240950631651518","147228350144465925776158818059329616532","294171572668465934090004360442390250078","172971984414156566578013168285329558882","76518826411347545341447968654201528111","287036674253239750820707615364040372431","206417983724872551403588071857369601531","190301942541846331735240089066313943299","154757172545440668849437570984911071","100297734200759198975563110441824994088","84340766976620446047067835708138334576","269935357300254612252527048833911171658","93748529309838173492175295853710082554","129424820874993847529116070963047870901","99288272290264190256935684522887741369","196170717154135016223665361339421510706","180123053493720674990987942453243609849","281096763625437540190994747829376358479","123092499724207133284550188084850397192","156377717540603171085481970823325384007","105753165065393061097919375976739557309","139898771205710912304203928656518890553","275352633607350611309317444743551248874","88680560123909053252903416597268864817","190053403352906738263237380846642625514","339538497369717774285633659512474045841","161257042474926511671723190410639702492","90172337027019397345288351449721830269","16715741445812420456573926249797038729","205176771747096583481240612923586690353","152362791468733055665976935012550848976","44212538362987457055731350574196867911","181064023028173555713855454994317145990","337902410219924545282653803910599949821","91667585988537952207731139706057645229","217197231109440792318246243204396185769","80395414593882684026713423127433193161","295965049720416209755283966195102050788","328409990110020075899118305897980857514","32243119026549283233982570865308124256","37370521536392696182337227700701599394","164206158968753388913360339446085506837","20735636875069941819492467197481235384","259599458677180427318374307621606341632","12013551146669531838324780270564938596","294341267680978015218234067028470766256","263263348386876433864499375321388411471","323720804791957688069070547868983161033","305744094165594011479926833270667333557","278790883106659125148446118266362472579","15205899426777232943331497851876553098","31324263582972619781281825666767614241","68680874598283766253091873972817936207"],"threshold":0.9},"id":"CVE-2026-52686-a5078232","signature_type":"Line","signature_version":"v1","source":"https://github.com/powerdns/pdns/commit/64c4f00f2b3d4d4153837e0dac7979108bb7749d","target":{"file":"pdns/recursordist/syncres.cc"}},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/powerdns/pdns/commit/64c4f00f2b3d4d4153837e0dac7979108bb7749d","target":{"file":"pdns/recursordist/syncres.cc","function":"SyncRes::updateCacheFromRecords"},"deprecated":false,"digest":{"function_hash":"65181445179713969558439273207228894381","length":12512},"id":"CVE-2026-52686-afb28141"},{"source":"https://github.com/powerdns/pdns/commit/b74225ba558d1f9f91afea21e2496e959b13a869","target":{"file":"pdns/recursordist/syncres.cc","function":"SyncRes::updateCacheFromRecords"},"deprecated":false,"digest":{"function_hash":"133502965729763685348340429062301544949","length":12552},"id":"CVE-2026-52686-c8900862","signature_type":"Function","signature_version":"v1"},{"source":"https://github.com/powerdns/pdns/commit/b74225ba558d1f9f91afea21e2496e959b13a869","target":{"file":"pdns/recursordist/test-syncres_cc5.cc"},"deprecated":false,"digest":{"line_hashes":["178873075834533611826354203572646335453","68263735809913871838746811403036930818","294444694510304319079283491520384127394"],"threshold":0.9},"id":"CVE-2026-52686-d2f627b9","signature_type":"Line","signature_version":"v1"},{"id":"CVE-2026-52686-e2cd8507","signature_type":"Function","signature_version":"v1","source":"https://github.com/powerdns/pdns/commit/53dfd1af948d1ff716bfd7615c99d442f984f2af","target":{"file":"pdns/recursordist/syncres.cc","function":"SyncRes::updateCacheFromRecords"},"deprecated":false,"digest":{"function_hash":"236375304593854131153234969050137430138","length":12398}},{"digest":{"line_hashes":["297690379756825001883693258821284086787","275190756499235142776542164331574414796","304084711605878169466962246458596650124","130405718195737931270165725987888592811","125364601277516619271008056276759613510","292339451060319529698601410068244870621","145368734622526732459095691986870150285","257641602359282688585110366670451835248","82276684157634677172891987079910472135","279568230016434762686300005486808232594","228454478493326969791383891315097681212","272307584847886740173261091502078231186","151186040936910880353869104747765600782","96634521900868265660556810104791666290","111690656414816116449727870568960866890","224175059376717234293934551562625711747","93205899823498420593240065338014104031","176113646396417689675597576401323210911","233368381172057152469052240950631651518","147228350144465925776158818059329616532","294171572668465934090004360442390250078","172971984414156566578013168285329558882","76518826411347545341447968654201528111","287036674253239750820707615364040372431","206417983724872551403588071857369601531","190301942541846331735240089066313943299","154757172545440668849437570984911071","100297734200759198975563110441824994088","84340766976620446047067835708138334576","269935357300254612252527048833911171658","93748529309838173492175295853710082554","129424820874993847529116070963047870901","99288272290264190256935684522887741369","196170717154135016223665361339421510706","180123053493720674990987942453243609849","281096763625437540190994747829376358479","123092499724207133284550188084850397192","156377717540603171085481970823325384007","105753165065393061097919375976739557309","139898771205710912304203928656518890553","275352633607350611309317444743551248874","88680560123909053252903416597268864817","190053403352906738263237380846642625514","339538497369717774285633659512474045841","161257042474926511671723190410639702492","90172337027019397345288351449721830269","16715741445812420456573926249797038729","205176771747096583481240612923586690353","152362791468733055665976935012550848976","44212538362987457055731350574196867911","181064023028173555713855454994317145990","337902410219924545282653803910599949821","108547899878426062504983998997034478399","248620222534135867042372373798025371446","333350224959081254437720271202562991339","106461829793279816888332070833781027351","328409990110020075899118305897980857514","32243119026549283233982570865308124256","37370521536392696182337227700701599394","164206158968753388913360339446085506837","20735636875069941819492467197481235384","259599458677180427318374307621606341632","12013551146669531838324780270564938596","294341267680978015218234067028470766256","146455459366941789385095040293914786464","10852551676209040866051156497043311505","147147281490762037630302429287068124692","73707210910882516307796677160556051752","15205899426777232943331497851876553098","31324263582972619781281825666767614241","68680874598283766253091873972817936207"],"threshold":0.9},"id":"CVE-2026-52686-fcb81cb8","signature_type":"Line","signature_version":"v1","source":"https://github.com/powerdns/pdns/commit/53dfd1af948d1ff716bfd7615c99d442f984f2af","target":{"file":"pdns/recursordist/syncres.cc"},"deprecated":false}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N"}]}